NetScreen防火墙培训 4.1-HA高可用性.pptVIP

HA高可用性 HA Link/Port/Zone HA1 – Primary path HA2 - Secondary NSRP Cluster Group of 2 NetScreens providing redundancy Identical configurations Changes to one propagated via HA link to the other Exceptions: Hostname – use cluster name to identify “device” for PKI, SNMP, authentication, etc. Some VSD settings Local interface settings Console settings Track IP configuration VSD/VSI/VSD Group Virtual Security Device Logical representation of a NetScreen VSD0 by default Virtual Security Interface Logical representation of interfaces VSD Group 2 NetScreens sharing VSD configuration VSD States and Failover Master Determined by priority Preempt Backup Initial Ineligible Inoperable Failover Gratuitous ARPs NSRP VSD Group - Active/Passive NetScreen-1 is the Master for VSD Group 0 The VSIs for VSD group 5 on NetScreen-1 forward data NetScreen-2 is the Primary Backup for VSD Group 0 The VSIs for VSD group 5 on NetScreen-2 are in backup and do not forward data NSRP VSD Group - Active/Active Run Time Objects (RTO) Objects created dynamically in memory Session table entries ARP cache entries DHCP leases IPSec security associations Syncing Sessions NSRP Configuration – Active/Passive NSRP Configuration Steps – Active/Passive On both devices Assign interface to HA zone (if not using dedicated HA ports) Configure cluster settings Configure interfaces to be monitored Adjust VSD settings (if desired) On one device Change interfaces, policies, etc. as desired Changes will automatically be copied via HA link 1: Assign Interface to HA Zone 2: Configure Cluster Settings 3: Set Interfaces for Monitoring 4: Adjust VSD settings Verifying NSRP Configuration Verifying NSRP Configuration NSRP Configuration Synchronization Factors that Affect Failover Time Heartbeat Messages Switching technologies Spanning Tree Protocol Channeling, Bonding, PAgP Trunking protocols Thank You Verifying NSRP Configuration * Copyright ? 2005 Juniper Networks, Inc. Proprietary and Confidential Copyright ? 20